--- /dev/null
+From 708dd66ce36f0e96594f8a2122e91753bd78b566 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Oct 2019 23:00:16 +0100
+Subject: 8250-men-mcb: fix error checking when get_num_ports returns -ENODEV
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f50b6805dbb993152025ec04dea094c40cc93a0c ]
+
+The current checking for failure on the number of ports fails when
+-ENODEV is returned from the call to get_num_ports. Fix this by making
+num_ports and loop counter i signed rather than unsigned ints. Also
+add check for num_ports being less than zero to check for -ve error
+returns.
+
+Addresses-Coverity: ("Unsigned compared against 0")
+Fixes: e2fea54e4592 ("8250-men-mcb: add support for 16z025 and 16z057")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Michael Moese <mmoese@suse.de>
+Link: https://lore.kernel.org/r/20191013220016.9369-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_men_mcb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_men_mcb.c b/drivers/tty/serial/8250/8250_men_mcb.c
+index 127017cc41d92..057b1eaf6d2eb 100644
+--- a/drivers/tty/serial/8250/8250_men_mcb.c
++++ b/drivers/tty/serial/8250/8250_men_mcb.c
+@@ -71,8 +71,8 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
+ {
+ struct serial_8250_men_mcb_data *data;
+ struct resource *mem;
+- unsigned int num_ports;
+- unsigned int i;
++ int num_ports;
++ int i;
+ void __iomem *membase;
+
+ mem = mcb_get_resource(mdev, IORESOURCE_MEM);
+@@ -87,7 +87,7 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
+ dev_dbg(&mdev->dev, "found a 16z%03u with %u ports\n",
+ mdev->id, num_ports);
+
+- if (num_ports == 0 || num_ports > 4) {
++ if (num_ports <= 0 || num_ports > 4) {
+ dev_err(&mdev->dev, "unexpected number of ports: %u\n",
+ num_ports);
+ return -ENODEV;
+@@ -132,7 +132,7 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
+
+ static void serial_8250_men_mcb_remove(struct mcb_device *mdev)
+ {
+- unsigned int num_ports, i;
++ int num_ports, i;
+ struct serial_8250_men_mcb_data *data = mcb_get_drvdata(mdev);
+
+ if (!data)
+--
+2.20.1
+
--- /dev/null
+From 7df37c35e8810abbfaad17e556b0e3841d901f46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 06:06:14 +0100
+Subject: ARM: 8926/1: v7m: remove register save to stack before svc
+
+From: afzal mohammed <afzal.mohd.ma@gmail.com>
+
+[ Upstream commit 2ecb287998a47cc0a766f6071f63bc185f338540 ]
+
+r0-r3 & r12 registers are saved & restored, before & after svc
+respectively. Intention was to preserve those registers across thread to
+handler mode switch.
+
+On v7-M, hardware saves the register context upon exception in AAPCS
+complaint way. Restoring r0-r3 & r12 is done from stack location where
+hardware saves it, not from the location on stack where these registers
+were saved.
+
+To clarify, on stm32f429 discovery board:
+
+1. before svc, sp - 0x90009ff8
+2. r0-r3,r12 saved to 0x90009ff8 - 0x9000a00b
+3. upon svc, h/w decrements sp by 32 & pushes registers onto stack
+4. after svc, sp - 0x90009fd8
+5. r0-r3,r12 restored from 0x90009fd8 - 0x90009feb
+
+Above means r0-r3,r12 is not restored from the location where they are
+saved, but since hardware pushes the registers onto stack, the registers
+are restored correctly.
+
+Note that during register saving to stack (step 2), it goes past
+0x9000a000. And it seems, based on objdump, there are global symbols
+residing there, and it perhaps can cause issues on a non-XIP Kernel
+(on XIP, data section is setup later).
+
+Based on the analysis above, manually saving registers onto stack is at
+best no-op and at worst can cause data section corruption. Hence remove
+storing of registers onto stack before svc.
+
+Fixes: b70cd406d7fe ("ARM: 8671/1: V7M: Preserve registers across switch from Thread to Handler mode")
+Signed-off-by: afzal mohammed <afzal.mohd.ma@gmail.com>
+Acked-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/proc-v7m.S | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S
+index 59d82864c134b..9c2978c128d97 100644
+--- a/arch/arm/mm/proc-v7m.S
++++ b/arch/arm/mm/proc-v7m.S
+@@ -135,7 +135,6 @@ __v7m_setup_cont:
+ dsb
+ mov r6, lr @ save LR
+ ldr sp, =init_thread_union + THREAD_START_SP
+- stmia sp, {r0-r3, r12}
+ cpsie i
+ svc #0
+ 1: cpsid i
+--
+2.20.1
+
--- /dev/null
+From d9a9ff140d30642f00033d4b6d110aeabb35c14d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 13:22:02 +0300
+Subject: ARM: davinci: dm365: Fix McBSP dma_slave_map entry
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 564b6bb9d42d31fc80c006658cf38940a9b99616 ]
+
+dm365 have only single McBSP, so the device name is without .0
+
+Fixes: 0c750e1fe481d ("ARM: davinci: dm365: Add dma_slave_map to edma")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/dm365.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
+index 42665914166a3..83ca89a353002 100644
+--- a/arch/arm/mach-davinci/dm365.c
++++ b/arch/arm/mach-davinci/dm365.c
+@@ -458,8 +458,8 @@ static s8 dm365_queue_priority_mapping[][2] = {
+ };
+
+ static const struct dma_slave_map dm365_edma_map[] = {
+- { "davinci-mcbsp.0", "tx", EDMA_FILTER_PARAM(0, 2) },
+- { "davinci-mcbsp.0", "rx", EDMA_FILTER_PARAM(0, 3) },
++ { "davinci-mcbsp", "tx", EDMA_FILTER_PARAM(0, 2) },
++ { "davinci-mcbsp", "rx", EDMA_FILTER_PARAM(0, 3) },
+ { "davinci_voicecodec", "tx", EDMA_FILTER_PARAM(0, 2) },
+ { "davinci_voicecodec", "rx", EDMA_FILTER_PARAM(0, 3) },
+ { "spi_davinci.2", "tx", EDMA_FILTER_PARAM(0, 10) },
+--
+2.20.1
+
--- /dev/null
+From 1f077f17f108f0759bacf36fbb35e7ddfa38164f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 08:43:42 +0800
+Subject: ARM: dts: imx7s: Correct GPT's ipg clock source
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 252b9e21bcf46b0d16f733f2e42b21fdc60addee ]
+
+i.MX7S/D's GPT ipg clock should be from GPT clock root and
+controlled by CCM's GPT CCGR, using correct clock source for
+GPT ipg clock instead of IMX7D_CLK_DUMMY.
+
+Fixes: 3ef79ca6bd1d ("ARM: dts: imx7d: use imx7s.dtsi as base device tree")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7s.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index a7f697b0290ff..90f5bdfa9b3ce 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -443,7 +443,7 @@
+ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+ reg = <0x302d0000 0x10000>;
+ interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_CLK_DUMMY>,
++ clocks = <&clks IMX7D_GPT1_ROOT_CLK>,
+ <&clks IMX7D_GPT1_ROOT_CLK>;
+ clock-names = "ipg", "per";
+ };
+@@ -452,7 +452,7 @@
+ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+ reg = <0x302e0000 0x10000>;
+ interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_CLK_DUMMY>,
++ clocks = <&clks IMX7D_GPT2_ROOT_CLK>,
+ <&clks IMX7D_GPT2_ROOT_CLK>;
+ clock-names = "ipg", "per";
+ status = "disabled";
+@@ -462,7 +462,7 @@
+ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+ reg = <0x302f0000 0x10000>;
+ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_CLK_DUMMY>,
++ clocks = <&clks IMX7D_GPT3_ROOT_CLK>,
+ <&clks IMX7D_GPT3_ROOT_CLK>;
+ clock-names = "ipg", "per";
+ status = "disabled";
+@@ -472,7 +472,7 @@
+ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt";
+ reg = <0x30300000 0x10000>;
+ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clks IMX7D_CLK_DUMMY>,
++ clocks = <&clks IMX7D_GPT4_ROOT_CLK>,
+ <&clks IMX7D_GPT4_ROOT_CLK>;
+ clock-names = "ipg", "per";
+ status = "disabled";
+--
+2.20.1
+
--- /dev/null
+From a93624c2753066732e0dca6aa8383138c74856af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 17:58:12 -0500
+Subject: ARM: dts: logicpd-torpedo-som: Remove twl_keypad
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 6b512b0ee091edcb8e46218894e4c917d919d3dc ]
+
+The TWL4030 used on the Logit PD Torpedo SOM does not have the
+keypad pins routed. This patch disables the twl_keypad driver
+to remove some splat during boot:
+
+twl4030_keypad 48070000.i2c:twl@48:keypad: missing or malformed property linux,keymap: -22
+twl4030_keypad 48070000.i2c:twl@48:keypad: Failed to build keymap
+twl4030_keypad: probe of 48070000.i2c:twl@48:keypad failed with error -22
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+[tony@atomide.com: removed error time stamps]
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+index 7d2302e8706c9..9354da4efe093 100644
+--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+@@ -196,3 +196,7 @@
+ &twl_gpio {
+ ti,use-leds;
+ };
++
++&twl_keypad {
++ status = "disabled";
++};
+--
+2.20.1
+
--- /dev/null
+From 2cd16694ea7e5b9ab5a63f6f0d11019d36fdf52d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2019 17:01:58 +0100
+Subject: ARM: mm: fix alignment handler faults under memory pressure
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 67e15fa5b487adb9b78a92789eeff2d6ec8f5cee ]
+
+When the system has high memory pressure, the page containing the
+instruction may be paged out. Using probe_kernel_address() means that
+if the page is swapped out, the resulting page fault will not be
+handled because page faults are disabled by this function.
+
+Use get_user() to read the instruction instead.
+
+Reported-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Fixes: b255188f90e2 ("ARM: fix scheduling while atomic warning in alignment handling code")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mm/alignment.c | 44 +++++++++++++++++++++++++++++++++--------
+ 1 file changed, 36 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index bd2c739d80839..84a6bbaf8cb20 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -768,6 +768,36 @@ do_alignment_t32_to_handler(unsigned long *pinstr, struct pt_regs *regs,
+ return NULL;
+ }
+
++static int alignment_get_arm(struct pt_regs *regs, u32 *ip, unsigned long *inst)
++{
++ u32 instr = 0;
++ int fault;
++
++ if (user_mode(regs))
++ fault = get_user(instr, ip);
++ else
++ fault = probe_kernel_address(ip, instr);
++
++ *inst = __mem_to_opcode_arm(instr);
++
++ return fault;
++}
++
++static int alignment_get_thumb(struct pt_regs *regs, u16 *ip, u16 *inst)
++{
++ u16 instr = 0;
++ int fault;
++
++ if (user_mode(regs))
++ fault = get_user(instr, ip);
++ else
++ fault = probe_kernel_address(ip, instr);
++
++ *inst = __mem_to_opcode_thumb16(instr);
++
++ return fault;
++}
++
+ static int
+ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ {
+@@ -775,10 +805,10 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ unsigned long instr = 0, instrptr;
+ int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
+ unsigned int type;
+- unsigned int fault;
+ u16 tinstr = 0;
+ int isize = 4;
+ int thumb2_32b = 0;
++ int fault;
+
+ if (interrupts_enabled(regs))
+ local_irq_enable();
+@@ -787,15 +817,14 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+
+ if (thumb_mode(regs)) {
+ u16 *ptr = (u16 *)(instrptr & ~1);
+- fault = probe_kernel_address(ptr, tinstr);
+- tinstr = __mem_to_opcode_thumb16(tinstr);
++
++ fault = alignment_get_thumb(regs, ptr, &tinstr);
+ if (!fault) {
+ if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
+ IS_T32(tinstr)) {
+ /* Thumb-2 32-bit */
+- u16 tinst2 = 0;
+- fault = probe_kernel_address(ptr + 1, tinst2);
+- tinst2 = __mem_to_opcode_thumb16(tinst2);
++ u16 tinst2;
++ fault = alignment_get_thumb(regs, ptr + 1, &tinst2);
+ instr = __opcode_thumb32_compose(tinstr, tinst2);
+ thumb2_32b = 1;
+ } else {
+@@ -804,8 +833,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ }
+ }
+ } else {
+- fault = probe_kernel_address((void *)instrptr, instr);
+- instr = __mem_to_opcode_arm(instr);
++ fault = alignment_get_arm(regs, (void *)instrptr, &instr);
+ }
+
+ if (fault) {
+--
+2.20.1
+
--- /dev/null
+From f4915352246610351320ffdee8f19e1c2da04a2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 20:42:35 +0200
+Subject: arm64: dts: allwinner: a64: pine64-plus: Add PHY regulator delay
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit 2511366797fa6ab4a404b4b000ef7cd262aaafe8 ]
+
+Depending on kernel and bootloader configuration, it's possible that
+Realtek ethernet PHY isn't powered on properly. According to the
+datasheet, it needs 30ms to power up and then some more time before it
+can be used.
+
+Fix that by adding 100ms ramp delay to regulator responsible for
+powering PHY.
+
+Fixes: 94dcfdc77fc5 ("arm64: allwinner: pine64-plus: Enable dwmac-sun8i")
+Suggested-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+index 24f1aac366d64..d5b6e8159a335 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+@@ -63,3 +63,12 @@
+ reg = <1>;
+ };
+ };
++
++®_dc1sw {
++ /*
++ * Ethernet PHY needs 30ms to properly power up and some more
++ * to initialize. 100ms should be plenty of time to finish
++ * whole process.
++ */
++ regulator-enable-ramp-delay = <100000>;
++};
+--
+2.20.1
+
--- /dev/null
+From e0f44560b41f959e96e9ed6058777476ed9e0fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 10:52:59 +0200
+Subject: arm64: dts: allwinner: a64: sopine-baseboard: Add PHY regulator delay
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit ccdf3aaa27ded6db9a93eed3ca7468bb2353b8fe ]
+
+It turns out that sopine-baseboard needs same fix as pine64-plus
+for ethernet PHY. Here too Realtek ethernet PHY chip needs additional
+power on delay to properly initialize. Datasheet mentions that chip
+needs 30 ms to be properly powered on and that it needs some more time
+to be initialized.
+
+Fix that by adding 100ms ramp delay to regulator responsible for
+powering PHY.
+
+Note that issue was found out and fix tested on pine64-lts, but it's
+basically the same as sopine-baseboard, only layout and connectors
+differ.
+
+Fixes: bdfe4cebea11 ("arm64: allwinner: a64: add Ethernet PHY regulator for several boards")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+index c21f2331add60..285cb7143b96c 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-sopine-baseboard.dts
+@@ -113,6 +113,12 @@
+ };
+
+ ®_dc1sw {
++ /*
++ * Ethernet PHY needs 30ms to properly power up and some more
++ * to initialize. 100ms should be plenty of time to finish
++ * whole process.
++ */
++ regulator-enable-ramp-delay = <100000>;
+ regulator-name = "vcc-phy";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From d67c9b0cd2f0eb53adf047adaffd1bf735e5e5d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Sep 2019 14:05:27 +0530
+Subject: arm64: dts: Fix gpio to pinmux mapping
+
+From: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+
+[ Upstream commit 965f6603e3335a953f4f876792074cb36bf65f7f ]
+
+There are total of 151 non-secure gpio (0-150) and four
+pins of pinmux (91, 92, 93 and 94) are not mapped to any
+gpio pin, hence update same in DT.
+
+Fixes: 8aa428cc1e2e ("arm64: dts: Add pinctrl DT nodes for Stingray SOC")
+Signed-off-by: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
+Reviewed-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi | 5 +++--
+ arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi | 3 +--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi
+index 8a3a770e8f2ce..56789ccf94545 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray-pinctrl.dtsi
+@@ -42,13 +42,14 @@
+
+ pinmux: pinmux@14029c {
+ compatible = "pinctrl-single";
+- reg = <0x0014029c 0x250>;
++ reg = <0x0014029c 0x26c>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+ pinctrl-single,register-width = <32>;
+ pinctrl-single,function-mask = <0xf>;
+ pinctrl-single,gpio-range = <
+- &range 0 154 MODE_GPIO
++ &range 0 91 MODE_GPIO
++ &range 95 60 MODE_GPIO
+ >;
+ range: gpio-range {
+ #pinctrl-single,gpio-range-cells = <3>;
+diff --git a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+index e283480bfc7e5..84101ea1fd2cb 100644
+--- a/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
++++ b/arch/arm64/boot/dts/broadcom/stingray/stingray.dtsi
+@@ -463,8 +463,7 @@
+ <&pinmux 108 16 27>,
+ <&pinmux 135 77 6>,
+ <&pinmux 141 67 4>,
+- <&pinmux 145 149 6>,
+- <&pinmux 151 91 4>;
++ <&pinmux 145 149 6>;
+ };
+
+ i2c1: i2c@e0000 {
+--
+2.20.1
+
--- /dev/null
+From b59c6adf9f8f4dfad420e5b4a2acd025cafc013e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 16:30:37 +0100
+Subject: ASoc: rockchip: i2s: Fix RPM imbalance
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit b1e620e7d32f5aad5353cc3cfc13ed99fea65d3a ]
+
+If rockchip_pcm_platform_register() fails, e.g. upon deferring to wait
+for an absent DMA channel, we return without disabling RPM, which makes
+subsequent re-probe attempts scream with errors about the unbalanced
+enable. Don't do that.
+
+Fixes: ebb75c0bdba2 ("ASoC: rockchip: i2s: Adjust devm usage")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/bcb12a849a05437fb18372bc7536c649b94bdf07.1570029862.git.robin.murphy@arm.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_i2s.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index 11399f81c92f9..b86f76c3598cd 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -677,7 +677,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
+ ret = rockchip_pcm_platform_register(&pdev->dev);
+ if (ret) {
+ dev_err(&pdev->dev, "Could not register PCM\n");
+- return ret;
++ goto err_suspend;
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From f5809a583b28e6f60fc08d4eadc97970a3270349 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 15:14:07 -0500
+Subject: ASoC: rt5682: add NULL handler to set_jack function
+
+From: Jaska Uimonen <jaska.uimonen@intel.com>
+
+[ Upstream commit a315e76fc544f09daf619530a7b2f85865e6b25e ]
+
+Implement NULL handler in set_jack function to disable
+irq's.
+
+Signed-off-by: Jaska Uimonen <jaska.uimonen@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190927201408.925-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5682.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c
+index 6f5dac09ceded..21e7c430baf7f 100644
+--- a/sound/soc/codecs/rt5682.c
++++ b/sound/soc/codecs/rt5682.c
+@@ -982,6 +982,16 @@ static int rt5682_set_jack_detect(struct snd_soc_component *component,
+ {
+ struct rt5682_priv *rt5682 = snd_soc_component_get_drvdata(component);
+
++ rt5682->hs_jack = hs_jack;
++
++ if (!hs_jack) {
++ regmap_update_bits(rt5682->regmap, RT5682_IRQ_CTRL_2,
++ RT5682_JD1_EN_MASK, RT5682_JD1_DIS);
++ regmap_update_bits(rt5682->regmap, RT5682_RC_CLK_CTRL,
++ RT5682_POW_JDH | RT5682_POW_JDL, 0);
++ return 0;
++ }
++
+ switch (rt5682->pdata.jd_src) {
+ case RT5682_JD1:
+ snd_soc_component_update_bits(component, RT5682_CBJ_CTRL_2,
+@@ -1019,8 +1029,6 @@ static int rt5682_set_jack_detect(struct snd_soc_component *component,
+ break;
+ }
+
+- rt5682->hs_jack = hs_jack;
+-
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 446655575faf0c5c259b674079bb116ac243e320 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 15:02:10 +0200
+Subject: ASoC: wm8994: Do not register inapplicable controls for WM1811
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+[ Upstream commit ca2347190adb5e4eece73a2b16e96e651c46246b ]
+
+In case of WM1811 device there are currently being registered controls
+referring to registers not existing on that device.
+It has been noticed when getting values of "AIF1ADC2 Volume", "AIF1DAC2
+Volume" controls was failing during ALSA state restoring at boot time:
+ "amixer: Mixer hw:0 load error: Device or resource busy"
+
+Reading some registers through I2C was failing with EBUSY error and
+indeed these registers were not available according to the datasheet.
+
+To fix this controls not available on WM1811 are moved to a separate
+array and registered only for WM8994 and WM8958.
+
+There are some further differences between WM8994 and WM1811,
+e.g. registers 603h, 604h, 605h, which are not covered in this patch.
+
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Link: https://lore.kernel.org/r/20190920130218.32690-2-s.nawrocki@samsung.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8994.c | 43 +++++++++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 17 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 14f1b0c0d286a..01acb8da2f48e 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -537,13 +537,10 @@ static SOC_ENUM_SINGLE_DECL(dac_osr,
+ static SOC_ENUM_SINGLE_DECL(adc_osr,
+ WM8994_OVERSAMPLING, 1, osr_text);
+
+-static const struct snd_kcontrol_new wm8994_snd_controls[] = {
++static const struct snd_kcontrol_new wm8994_common_snd_controls[] = {
+ SOC_DOUBLE_R_TLV("AIF1ADC1 Volume", WM8994_AIF1_ADC1_LEFT_VOLUME,
+ WM8994_AIF1_ADC1_RIGHT_VOLUME,
+ 1, 119, 0, digital_tlv),
+-SOC_DOUBLE_R_TLV("AIF1ADC2 Volume", WM8994_AIF1_ADC2_LEFT_VOLUME,
+- WM8994_AIF1_ADC2_RIGHT_VOLUME,
+- 1, 119, 0, digital_tlv),
+ SOC_DOUBLE_R_TLV("AIF2ADC Volume", WM8994_AIF2_ADC_LEFT_VOLUME,
+ WM8994_AIF2_ADC_RIGHT_VOLUME,
+ 1, 119, 0, digital_tlv),
+@@ -560,8 +557,6 @@ SOC_ENUM("AIF2DACR Source", aif2dacr_src),
+
+ SOC_DOUBLE_R_TLV("AIF1DAC1 Volume", WM8994_AIF1_DAC1_LEFT_VOLUME,
+ WM8994_AIF1_DAC1_RIGHT_VOLUME, 1, 96, 0, digital_tlv),
+-SOC_DOUBLE_R_TLV("AIF1DAC2 Volume", WM8994_AIF1_DAC2_LEFT_VOLUME,
+- WM8994_AIF1_DAC2_RIGHT_VOLUME, 1, 96, 0, digital_tlv),
+ SOC_DOUBLE_R_TLV("AIF2DAC Volume", WM8994_AIF2_DAC_LEFT_VOLUME,
+ WM8994_AIF2_DAC_RIGHT_VOLUME, 1, 96, 0, digital_tlv),
+
+@@ -569,17 +564,12 @@ SOC_SINGLE_TLV("AIF1 Boost Volume", WM8994_AIF1_CONTROL_2, 10, 3, 0, aif_tlv),
+ SOC_SINGLE_TLV("AIF2 Boost Volume", WM8994_AIF2_CONTROL_2, 10, 3, 0, aif_tlv),
+
+ SOC_SINGLE("AIF1DAC1 EQ Switch", WM8994_AIF1_DAC1_EQ_GAINS_1, 0, 1, 0),
+-SOC_SINGLE("AIF1DAC2 EQ Switch", WM8994_AIF1_DAC2_EQ_GAINS_1, 0, 1, 0),
+ SOC_SINGLE("AIF2 EQ Switch", WM8994_AIF2_EQ_GAINS_1, 0, 1, 0),
+
+ WM8994_DRC_SWITCH("AIF1DAC1 DRC Switch", WM8994_AIF1_DRC1_1, 2),
+ WM8994_DRC_SWITCH("AIF1ADC1L DRC Switch", WM8994_AIF1_DRC1_1, 1),
+ WM8994_DRC_SWITCH("AIF1ADC1R DRC Switch", WM8994_AIF1_DRC1_1, 0),
+
+-WM8994_DRC_SWITCH("AIF1DAC2 DRC Switch", WM8994_AIF1_DRC2_1, 2),
+-WM8994_DRC_SWITCH("AIF1ADC2L DRC Switch", WM8994_AIF1_DRC2_1, 1),
+-WM8994_DRC_SWITCH("AIF1ADC2R DRC Switch", WM8994_AIF1_DRC2_1, 0),
+-
+ WM8994_DRC_SWITCH("AIF2DAC DRC Switch", WM8994_AIF2_DRC_1, 2),
+ WM8994_DRC_SWITCH("AIF2ADCL DRC Switch", WM8994_AIF2_DRC_1, 1),
+ WM8994_DRC_SWITCH("AIF2ADCR DRC Switch", WM8994_AIF2_DRC_1, 0),
+@@ -598,9 +588,6 @@ SOC_SINGLE("Sidetone HPF Switch", WM8994_SIDETONE, 6, 1, 0),
+ SOC_ENUM("AIF1ADC1 HPF Mode", aif1adc1_hpf),
+ SOC_DOUBLE("AIF1ADC1 HPF Switch", WM8994_AIF1_ADC1_FILTERS, 12, 11, 1, 0),
+
+-SOC_ENUM("AIF1ADC2 HPF Mode", aif1adc2_hpf),
+-SOC_DOUBLE("AIF1ADC2 HPF Switch", WM8994_AIF1_ADC2_FILTERS, 12, 11, 1, 0),
+-
+ SOC_ENUM("AIF2ADC HPF Mode", aif2adc_hpf),
+ SOC_DOUBLE("AIF2ADC HPF Switch", WM8994_AIF2_ADC_FILTERS, 12, 11, 1, 0),
+
+@@ -641,6 +628,24 @@ SOC_SINGLE("AIF2DAC 3D Stereo Switch", WM8994_AIF2_DAC_FILTERS_2,
+ 8, 1, 0),
+ };
+
++/* Controls not available on WM1811 */
++static const struct snd_kcontrol_new wm8994_snd_controls[] = {
++SOC_DOUBLE_R_TLV("AIF1ADC2 Volume", WM8994_AIF1_ADC2_LEFT_VOLUME,
++ WM8994_AIF1_ADC2_RIGHT_VOLUME,
++ 1, 119, 0, digital_tlv),
++SOC_DOUBLE_R_TLV("AIF1DAC2 Volume", WM8994_AIF1_DAC2_LEFT_VOLUME,
++ WM8994_AIF1_DAC2_RIGHT_VOLUME, 1, 96, 0, digital_tlv),
++
++SOC_SINGLE("AIF1DAC2 EQ Switch", WM8994_AIF1_DAC2_EQ_GAINS_1, 0, 1, 0),
++
++WM8994_DRC_SWITCH("AIF1DAC2 DRC Switch", WM8994_AIF1_DRC2_1, 2),
++WM8994_DRC_SWITCH("AIF1ADC2L DRC Switch", WM8994_AIF1_DRC2_1, 1),
++WM8994_DRC_SWITCH("AIF1ADC2R DRC Switch", WM8994_AIF1_DRC2_1, 0),
++
++SOC_ENUM("AIF1ADC2 HPF Mode", aif1adc2_hpf),
++SOC_DOUBLE("AIF1ADC2 HPF Switch", WM8994_AIF1_ADC2_FILTERS, 12, 11, 1, 0),
++};
++
+ static const struct snd_kcontrol_new wm8994_eq_controls[] = {
+ SOC_SINGLE_TLV("AIF1DAC1 EQ1 Volume", WM8994_AIF1_DAC1_EQ_GAINS_1, 11, 31, 0,
+ eq_tlv),
+@@ -4262,13 +4267,15 @@ static int wm8994_component_probe(struct snd_soc_component *component)
+ wm8994_handle_pdata(wm8994);
+
+ wm_hubs_add_analogue_controls(component);
+- snd_soc_add_component_controls(component, wm8994_snd_controls,
+- ARRAY_SIZE(wm8994_snd_controls));
++ snd_soc_add_component_controls(component, wm8994_common_snd_controls,
++ ARRAY_SIZE(wm8994_common_snd_controls));
+ snd_soc_dapm_new_controls(dapm, wm8994_dapm_widgets,
+ ARRAY_SIZE(wm8994_dapm_widgets));
+
+ switch (control->type) {
+ case WM8994:
++ snd_soc_add_component_controls(component, wm8994_snd_controls,
++ ARRAY_SIZE(wm8994_snd_controls));
+ snd_soc_dapm_new_controls(dapm, wm8994_specific_dapm_widgets,
+ ARRAY_SIZE(wm8994_specific_dapm_widgets));
+ if (control->revision < 4) {
+@@ -4288,8 +4295,10 @@ static int wm8994_component_probe(struct snd_soc_component *component)
+ }
+ break;
+ case WM8958:
++ snd_soc_add_component_controls(component, wm8994_snd_controls,
++ ARRAY_SIZE(wm8994_snd_controls));
+ snd_soc_add_component_controls(component, wm8958_snd_controls,
+- ARRAY_SIZE(wm8958_snd_controls));
++ ARRAY_SIZE(wm8958_snd_controls));
+ snd_soc_dapm_new_controls(dapm, wm8958_dapm_widgets,
+ ARRAY_SIZE(wm8958_dapm_widgets));
+ if (control->revision < 1) {
+--
+2.20.1
+
--- /dev/null
+From 2f56be8b7c40bbf9085bf2cf2a2dd5cac53a59ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 09:42:40 +0100
+Subject: ASoC: wm_adsp: Don't generate kcontrols without READ flags
+
+From: Stuart Henderson <stuarth@opensource.cirrus.com>
+
+[ Upstream commit 3ae7359c0e39f42a96284d6798fc669acff38140 ]
+
+User space always expects to be able to read ALSA controls, so ensure
+no kcontrols are generated without an appropriate READ flag. In the case
+of a read of such a control zeros will be returned.
+
+Signed-off-by: Stuart Henderson <stuarth@opensource.cirrus.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20191002084240.21589-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm_adsp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index ee85056a85774..b114fc7b2a95e 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -1147,8 +1147,7 @@ static unsigned int wmfw_convert_flags(unsigned int in, unsigned int len)
+ }
+
+ if (in) {
+- if (in & WMFW_CTL_FLAG_READABLE)
+- out |= rd;
++ out |= rd;
+ if (in & WMFW_CTL_FLAG_WRITEABLE)
+ out |= wr;
+ if (in & WMFW_CTL_FLAG_VOLATILE)
+--
+2.20.1
+
--- /dev/null
+From 4c10aade18eba501074ded55542973c0afa35e29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 05:02:33 -0400
+Subject: cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
+
+From: Dave Wysochanski <dwysocha@redhat.com>
+
+[ Upstream commit d46b0da7a33dd8c99d969834f682267a45444ab3 ]
+
+There's a deadlock that is possible and can easily be seen with
+a test where multiple readers open/read/close of the same file
+and a disruption occurs causing reconnect. The deadlock is due
+a reader thread inside cifs_strict_readv calling down_read and
+obtaining lock_sem, and then after reconnect inside
+cifs_reopen_file calling down_read a second time. If in
+between the two down_read calls, a down_write comes from
+another process, deadlock occurs.
+
+ CPU0 CPU1
+ ---- ----
+cifs_strict_readv()
+ down_read(&cifsi->lock_sem);
+ _cifsFileInfo_put
+ OR
+ cifs_new_fileinfo
+ down_write(&cifsi->lock_sem);
+cifs_reopen_file()
+ down_read(&cifsi->lock_sem);
+
+Fix the above by changing all down_write(lock_sem) calls to
+down_write_trylock(lock_sem)/msleep() loop, which in turn
+makes the second down_read call benign since it will never
+block behind the writer while holding lock_sem.
+
+Signed-off-by: Dave Wysochanski <dwysocha@redhat.com>
+Suggested-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed--by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifsglob.h | 5 +++++
+ fs/cifs/cifsproto.h | 1 +
+ fs/cifs/file.c | 23 +++++++++++++++--------
+ fs/cifs/smb2file.c | 2 +-
+ 4 files changed, 22 insertions(+), 9 deletions(-)
+
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 4dbae6e268d6a..71c2dd0c7f038 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1286,6 +1286,11 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);
+ struct cifsInodeInfo {
+ bool can_cache_brlcks;
+ struct list_head llist; /* locks helb by this inode */
++ /*
++ * NOTE: Some code paths call down_read(lock_sem) twice, so
++ * we must always use use cifs_down_write() instead of down_write()
++ * for this semaphore to avoid deadlocks.
++ */
+ struct rw_semaphore lock_sem; /* protect the fields above */
+ /* BB add in lists for dirty pages i.e. write caching info for oplock */
+ struct list_head openFileList;
+diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
+index 20adda4de83be..d7ac75ea881c7 100644
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -159,6 +159,7 @@ extern int cifs_unlock_range(struct cifsFileInfo *cfile,
+ struct file_lock *flock, const unsigned int xid);
+ extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile);
+
++extern void cifs_down_write(struct rw_semaphore *sem);
+ extern struct cifsFileInfo *cifs_new_fileinfo(struct cifs_fid *fid,
+ struct file *file,
+ struct tcon_link *tlink,
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index b4e33ef2ff315..a8e2bc47dcf27 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -280,6 +280,13 @@ cifs_has_mand_locks(struct cifsInodeInfo *cinode)
+ return has_locks;
+ }
+
++void
++cifs_down_write(struct rw_semaphore *sem)
++{
++ while (!down_write_trylock(sem))
++ msleep(10);
++}
++
+ struct cifsFileInfo *
+ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ struct tcon_link *tlink, __u32 oplock)
+@@ -305,7 +312,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
+ INIT_LIST_HEAD(&fdlocks->locks);
+ fdlocks->cfile = cfile;
+ cfile->llist = fdlocks;
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ list_add(&fdlocks->llist, &cinode->llist);
+ up_write(&cinode->lock_sem);
+
+@@ -461,7 +468,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ * Delete any outstanding lock records. We'll lose them when the file
+ * is closed anyway.
+ */
+- down_write(&cifsi->lock_sem);
++ cifs_down_write(&cifsi->lock_sem);
+ list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) {
+ list_del(&li->llist);
+ cifs_del_lock_waiters(li);
+@@ -1016,7 +1023,7 @@ static void
+ cifs_lock_add(struct cifsFileInfo *cfile, struct cifsLockInfo *lock)
+ {
+ struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry));
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ list_add_tail(&lock->llist, &cfile->llist->locks);
+ up_write(&cinode->lock_sem);
+ }
+@@ -1038,7 +1045,7 @@ cifs_lock_add_if(struct cifsFileInfo *cfile, struct cifsLockInfo *lock,
+
+ try_again:
+ exist = false;
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+
+ exist = cifs_find_lock_conflict(cfile, lock->offset, lock->length,
+ lock->type, &conf_lock, CIFS_LOCK_OP);
+@@ -1060,7 +1067,7 @@ cifs_lock_add_if(struct cifsFileInfo *cfile, struct cifsLockInfo *lock,
+ (lock->blist.next == &lock->blist));
+ if (!rc)
+ goto try_again;
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ list_del_init(&lock->blist);
+ }
+
+@@ -1113,7 +1120,7 @@ cifs_posix_lock_set(struct file *file, struct file_lock *flock)
+ return rc;
+
+ try_again:
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ if (!cinode->can_cache_brlcks) {
+ up_write(&cinode->lock_sem);
+ return rc;
+@@ -1319,7 +1326,7 @@ cifs_push_locks(struct cifsFileInfo *cfile)
+ int rc = 0;
+
+ /* we are going to update can_cache_brlcks here - need a write access */
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ if (!cinode->can_cache_brlcks) {
+ up_write(&cinode->lock_sem);
+ return rc;
+@@ -1510,7 +1517,7 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+ if (!buf)
+ return -ENOMEM;
+
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ for (i = 0; i < 2; i++) {
+ cur = buf;
+ num = 0;
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index b204e84b87fb5..9168b2266e4fa 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -137,7 +137,7 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,
+
+ cur = buf;
+
+- down_write(&cinode->lock_sem);
++ cifs_down_write(&cinode->lock_sem);
+ list_for_each_entry_safe(li, tmp, &cfile->llist->locks, llist) {
+ if (flock->fl_start > li->offset ||
+ (flock->fl_start + length) <
+--
+2.20.1
+
--- /dev/null
+From a00da2e5653a72d9bc644d340622cdf7d8f2b607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 10:38:57 +0200
+Subject: drm/amdgpu: fix potential VM faults
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit 3122051edc7c27cc08534be730f4c7c180919b8a ]
+
+When we allocate new page tables under memory
+pressure we should not evict old ones.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+index b0e14a3d54efd..b14ce112703f0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+@@ -428,7 +428,8 @@ static int amdgpu_bo_do_create(struct amdgpu_device *adev,
+ .interruptible = (bp->type != ttm_bo_type_kernel),
+ .no_wait_gpu = false,
+ .resv = bp->resv,
+- .flags = TTM_OPT_FLAG_ALLOW_RES_EVICT
++ .flags = bp->type != ttm_bo_type_kernel ?
++ TTM_OPT_FLAG_ALLOW_RES_EVICT : 0
+ };
+ struct amdgpu_bo *bo;
+ unsigned long page_align, size = bp->size;
+--
+2.20.1
+
--- /dev/null
+From 2d7e55646db7762a174b85b078b51a4659a7e7e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 10:51:09 +0200
+Subject: i2c: stm32f7: fix a race in slave mode with arbitration loss irq
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+[ Upstream commit 6d6b0d0d5afc8c4c84b08261260ba11dfa5206f2 ]
+
+When in slave mode, an arbitration loss (ARLO) may be detected before the
+slave had a chance to detect the stop condition (STOPF in ISR).
+This is seen when two master + slave adapters switch their roles. It
+provokes the i2c bus to be stuck, busy as SCL line is stretched.
+- the I2C_SLAVE_STOP event is never generated due to STOPF flag is set but
+ don't generate an irq (race with ARLO irq, STOPIE is masked). STOPF flag
+ remains set until next master xfer (e.g. when STOPIE irq get unmasked).
+ In this case, completion is generated too early: immediately upon new
+ transfer request (then it doesn't send all data).
+- Some data get stuck in TXDR register. As a consequence, the controller
+ stretches the SCL line: the bus gets busy until a future master transfer
+ triggers the bus busy / recovery mechanism (this can take time... and
+ may never happen at all)
+
+So choice is to let the STOPF being detected by the slave isr handler,
+to properly handle this stop condition. E.g. don't mask IRQs in error
+handler, when the slave is running.
+
+Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support")
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index 48521bc8a4d23..362b23505f214 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1488,7 +1488,7 @@ static irqreturn_t stm32f7_i2c_isr_error(int irq, void *data)
+ void __iomem *base = i2c_dev->base;
+ struct device *dev = i2c_dev->dev;
+ struct stm32_i2c_dma *dma = i2c_dev->dma;
+- u32 mask, status;
++ u32 status;
+
+ status = readl_relaxed(i2c_dev->base + STM32F7_I2C_ISR);
+
+@@ -1513,12 +1513,15 @@ static irqreturn_t stm32f7_i2c_isr_error(int irq, void *data)
+ f7_msg->result = -EINVAL;
+ }
+
+- /* Disable interrupts */
+- if (stm32f7_i2c_is_slave_registered(i2c_dev))
+- mask = STM32F7_I2C_XFER_IRQ_MASK;
+- else
+- mask = STM32F7_I2C_ALL_IRQ_MASK;
+- stm32f7_i2c_disable_irq(i2c_dev, mask);
++ if (!i2c_dev->slave_running) {
++ u32 mask;
++ /* Disable interrupts */
++ if (stm32f7_i2c_is_slave_registered(i2c_dev))
++ mask = STM32F7_I2C_XFER_IRQ_MASK;
++ else
++ mask = STM32F7_I2C_ALL_IRQ_MASK;
++ stm32f7_i2c_disable_irq(i2c_dev, mask);
++ }
+
+ /* Disable dma */
+ if (i2c_dev->use_dma) {
+--
+2.20.1
+
--- /dev/null
+From a6870d14f81fcfdea1455db7b13b26e26a40b839 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 17:28:01 +0200
+Subject: i2c: stm32f7: fix first byte to send in slave mode
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+[ Upstream commit 02e64276c6dbcc4c5f39844f33d18180832a58f3 ]
+
+The slave-interface documentation [1] states "the bus driver should
+transmit the first byte" upon I2C_SLAVE_READ_REQUESTED slave event:
+- 'val': backend returns first byte to be sent
+The driver currently ignores the 1st byte to send on this event.
+
+[1] https://www.kernel.org/doc/Documentation/i2c/slave-interface
+
+Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support")
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index ac9c9486b834c..48521bc8a4d23 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1177,6 +1177,8 @@ static void stm32f7_i2c_slave_start(struct stm32f7_i2c_dev *i2c_dev)
+ STM32F7_I2C_CR1_TXIE;
+ stm32f7_i2c_set_bits(base + STM32F7_I2C_CR1, mask);
+
++ /* Write 1st data byte */
++ writel_relaxed(value, base + STM32F7_I2C_TXDR);
+ } else {
+ /* Notify i2c slave that new write transfer is starting */
+ i2c_slave_event(slave, I2C_SLAVE_WRITE_REQUESTED, &value);
+--
+2.20.1
+
--- /dev/null
+From 03f22909576da3e75a16245eab6388f0ffa53168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2019 15:11:58 +0200
+Subject: i2c: stm32f7: remove warning when compiling with W=1
+
+From: Alain Volmat <alain.volmat@st.com>
+
+[ Upstream commit 348e46fbb4cdb2aead79aee1fd8bb25ec5fd25db ]
+
+Remove the following warning:
+
+drivers/i2c/busses/i2c-stm32f7.c:315:
+warning: cannot understand function prototype:
+'struct stm32f7_i2c_spec i2c_specs[] =
+
+Replace a comment starting with /** by simply /* to avoid having
+it interpreted as a kernel-doc comment.
+
+Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver")
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32f7.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index 362b23505f214..f4e3613f9361b 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -297,7 +297,7 @@ struct stm32f7_i2c_dev {
+ bool use_dma;
+ };
+
+-/**
++/*
+ * All these values are coming from I2C Specification, Version 6.0, 4th of
+ * April 2014.
+ *
+--
+2.20.1
+
--- /dev/null
+From ca237f831bcb363d97291eda0e829ece30dfc887 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 03:46:26 +0000
+Subject: irqchip/gic-v3-its: Use the exact ITSList for VMOVP
+
+From: Zenghui Yu <yuzenghui@huawei.com>
+
+[ Upstream commit 8424312516e5d9baeeb0a95d0e4523579b7aa395 ]
+
+On a system without Single VMOVP support (say GITS_TYPER.VMOVP == 0),
+we will map vPEs only on ITSs that will actually control interrupts
+for the given VM. And when moving a vPE, the VMOVP command will be
+issued only for those ITSs.
+
+But when issuing VMOVPs we seemed fail to present the exact ITSList
+to ITSs who are actually included in the synchronization operation.
+The its_list_map we're currently using includes all ITSs in the system,
+even though some of them don't have the corresponding vPE mapping at all.
+
+Introduce get_its_list() to get the per-VM its_list_map, to indicate
+which ITSs have vPE mappings for the given VM, and use this map as
+the expected ITSList when building VMOVP. This is hopefully a performance
+gain not to do some synchronization with those unsuspecting ITSs.
+And initialize the whole command descriptor to zero at beginning, since
+the seq_num and its_list should be RES0 when GITS_TYPER.VMOVP == 1.
+
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/1571802386-2680-1-git-send-email-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index e7549a2b1482b..050d6e040128d 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -182,6 +182,22 @@ static DEFINE_IDA(its_vpeid_ida);
+ #define gic_data_rdist_rd_base() (gic_data_rdist()->rd_base)
+ #define gic_data_rdist_vlpi_base() (gic_data_rdist_rd_base() + SZ_128K)
+
++static u16 get_its_list(struct its_vm *vm)
++{
++ struct its_node *its;
++ unsigned long its_list = 0;
++
++ list_for_each_entry(its, &its_nodes, entry) {
++ if (!its->is_v4)
++ continue;
++
++ if (vm->vlpi_count[its->list_nr])
++ __set_bit(its->list_nr, &its_list);
++ }
++
++ return (u16)its_list;
++}
++
+ static struct its_collection *dev_event_to_col(struct its_device *its_dev,
+ u32 event)
+ {
+@@ -983,17 +999,15 @@ static void its_send_vmapp(struct its_node *its,
+
+ static void its_send_vmovp(struct its_vpe *vpe)
+ {
+- struct its_cmd_desc desc;
++ struct its_cmd_desc desc = {};
+ struct its_node *its;
+ unsigned long flags;
+ int col_id = vpe->col_idx;
+
+ desc.its_vmovp_cmd.vpe = vpe;
+- desc.its_vmovp_cmd.its_list = (u16)its_list_map;
+
+ if (!its_list_map) {
+ its = list_first_entry(&its_nodes, struct its_node, entry);
+- desc.its_vmovp_cmd.seq_num = 0;
+ desc.its_vmovp_cmd.col = &its->collections[col_id];
+ its_send_single_vcommand(its, its_build_vmovp_cmd, &desc);
+ return;
+@@ -1010,6 +1024,7 @@ static void its_send_vmovp(struct its_vpe *vpe)
+ raw_spin_lock_irqsave(&vmovp_lock, flags);
+
+ desc.its_vmovp_cmd.seq_num = vmovp_seq_num++;
++ desc.its_vmovp_cmd.its_list = get_its_list(vpe->its_vm);
+
+ /* Emit VMOVPs */
+ list_for_each_entry(its, &its_nodes, entry) {
+--
+2.20.1
+
--- /dev/null
+From 6867fb2f3f772f50bb726adf7f1d2b35435a12ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jul 2019 11:06:26 -0500
+Subject: kbuild: add -fcf-protection=none when using retpoline flags
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+[ Upstream commit 29be86d7f9cb18df4123f309ac7857570513e8bc ]
+
+The gcc -fcf-protection=branch option is not compatible with
+-mindirect-branch=thunk-extern. The latter is used when
+CONFIG_RETPOLINE is selected, and this will fail to build with
+a gcc which has -fcf-protection=branch enabled by default. Adding
+-fcf-protection=none when building with retpoline enabled
+prevents such build failures.
+
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/Makefile b/Makefile
+index 6af1c13d8753b..729467fe0933f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -835,6 +835,12 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=designated-init)
+ # change __FILE__ to the relative path from the srctree
+ KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=)
+
++# ensure -fcf-protection is disabled when using retpoline as it is
++# incompatible with -mindirect-branch=thunk-extern
++ifdef CONFIG_RETPOLINE
++KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
++endif
++
+ # use the deterministic mode of AR if available
+ KBUILD_ARFLAGS := $(call ar-option,D)
+
+--
+2.20.1
+
--- /dev/null
+From 74c53b700433cc0fac873d3f2f3e5466997a31f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 21:11:00 +0200
+Subject: MIPS: bmips: mark exception vectors as char arrays
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit e4f5cb1a9b27c0f94ef4f5a0178a3fde2d3d0e9e ]
+
+The vectors span more than one byte, so mark them as arrays.
+
+Fixes the following build error when building when using GCC 8.3:
+
+In file included from ./include/linux/string.h:19,
+ from ./include/linux/bitmap.h:9,
+ from ./include/linux/cpumask.h:12,
+ from ./arch/mips/include/asm/processor.h:15,
+ from ./arch/mips/include/asm/thread_info.h:16,
+ from ./include/linux/thread_info.h:38,
+ from ./include/asm-generic/preempt.h:5,
+ from ./arch/mips/include/generated/asm/preempt.h:1,
+ from ./include/linux/preempt.h:81,
+ from ./include/linux/spinlock.h:51,
+ from ./include/linux/mmzone.h:8,
+ from ./include/linux/bootmem.h:8,
+ from arch/mips/bcm63xx/prom.c:10:
+arch/mips/bcm63xx/prom.c: In function 'prom_init':
+./arch/mips/include/asm/string.h:162:11: error: '__builtin_memcpy' forming offset [2, 32] is out of the bounds [0, 1] of object 'bmips_smp_movevec' with type 'char' [-Werror=array-bounds]
+ __ret = __builtin_memcpy((dst), (src), __len); \
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+arch/mips/bcm63xx/prom.c:97:3: note: in expansion of macro 'memcpy'
+ memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20);
+ ^~~~~~
+In file included from arch/mips/bcm63xx/prom.c:14:
+./arch/mips/include/asm/bmips.h:80:13: note: 'bmips_smp_movevec' declared here
+ extern char bmips_smp_movevec;
+
+Fixes: 18a1eef92dcd ("MIPS: BMIPS: Introduce bmips.h")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm63xx/prom.c | 2 +-
+ arch/mips/include/asm/bmips.h | 10 +++++-----
+ arch/mips/kernel/smp-bmips.c | 8 ++++----
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/mips/bcm63xx/prom.c b/arch/mips/bcm63xx/prom.c
+index 7019e2967009e..bbbf8057565b2 100644
+--- a/arch/mips/bcm63xx/prom.c
++++ b/arch/mips/bcm63xx/prom.c
+@@ -84,7 +84,7 @@ void __init prom_init(void)
+ * Here we will start up CPU1 in the background and ask it to
+ * reconfigure itself then go back to sleep.
+ */
+- memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20);
++ memcpy((void *)0xa0000200, bmips_smp_movevec, 0x20);
+ __sync();
+ set_c0_cause(C_SW0);
+ cpumask_set_cpu(1, &bmips_booted_mask);
+diff --git a/arch/mips/include/asm/bmips.h b/arch/mips/include/asm/bmips.h
+index bf6a8afd7ad27..581a6a3c66e40 100644
+--- a/arch/mips/include/asm/bmips.h
++++ b/arch/mips/include/asm/bmips.h
+@@ -75,11 +75,11 @@ static inline int register_bmips_smp_ops(void)
+ #endif
+ }
+
+-extern char bmips_reset_nmi_vec;
+-extern char bmips_reset_nmi_vec_end;
+-extern char bmips_smp_movevec;
+-extern char bmips_smp_int_vec;
+-extern char bmips_smp_int_vec_end;
++extern char bmips_reset_nmi_vec[];
++extern char bmips_reset_nmi_vec_end[];
++extern char bmips_smp_movevec[];
++extern char bmips_smp_int_vec[];
++extern char bmips_smp_int_vec_end[];
+
+ extern int bmips_smp_enabled;
+ extern int bmips_cpu_offset;
+diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
+index 159e83add4bb3..5ec546b5eed1c 100644
+--- a/arch/mips/kernel/smp-bmips.c
++++ b/arch/mips/kernel/smp-bmips.c
+@@ -457,10 +457,10 @@ static void bmips_wr_vec(unsigned long dst, char *start, char *end)
+
+ static inline void bmips_nmi_handler_setup(void)
+ {
+- bmips_wr_vec(BMIPS_NMI_RESET_VEC, &bmips_reset_nmi_vec,
+- &bmips_reset_nmi_vec_end);
+- bmips_wr_vec(BMIPS_WARM_RESTART_VEC, &bmips_smp_int_vec,
+- &bmips_smp_int_vec_end);
++ bmips_wr_vec(BMIPS_NMI_RESET_VEC, bmips_reset_nmi_vec,
++ bmips_reset_nmi_vec_end);
++ bmips_wr_vec(BMIPS_WARM_RESTART_VEC, bmips_smp_int_vec,
++ bmips_smp_int_vec_end);
+ }
+
+ struct reset_vec_info {
+--
+2.20.1
+
--- /dev/null
+From a43d2b19ef361898e598091e5f9d8c830589e943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 15:56:28 -0400
+Subject: nbd: handle racing with error'ed out commands
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 7ce23e8e0a9cd38338fc8316ac5772666b565ca9 ]
+
+We hit the following warning in production
+
+print_req_error: I/O error, dev nbd0, sector 7213934408 flags 80700
+------------[ cut here ]------------
+refcount_t: underflow; use-after-free.
+WARNING: CPU: 25 PID: 32407 at lib/refcount.c:190 refcount_sub_and_test_checked+0x53/0x60
+Workqueue: knbd-recv recv_work [nbd]
+RIP: 0010:refcount_sub_and_test_checked+0x53/0x60
+Call Trace:
+ blk_mq_free_request+0xb7/0xf0
+ blk_mq_complete_request+0x62/0xf0
+ recv_work+0x29/0xa1 [nbd]
+ process_one_work+0x1f5/0x3f0
+ worker_thread+0x2d/0x3d0
+ ? rescuer_thread+0x340/0x340
+ kthread+0x111/0x130
+ ? kthread_create_on_node+0x60/0x60
+ ret_from_fork+0x1f/0x30
+---[ end trace b079c3c67f98bb7c ]---
+
+This was preceded by us timing out everything and shutting down the
+sockets for the device. The problem is we had a request in the queue at
+the same time, so we completed the request twice. This can actually
+happen in a lot of cases, we fail to get a ref on our config, we only
+have one connection and just error out the command, etc.
+
+Fix this by checking cmd->status in nbd_read_stat. We only change this
+under the cmd->lock, so we are safe to check this here and see if we've
+already error'ed this command out, which would indicate that we've
+completed it as well.
+
+Reviewed-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index da6a36d14f4cf..867841c56a6da 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -663,6 +663,12 @@ static struct nbd_cmd *nbd_read_stat(struct nbd_device *nbd, int index)
+ ret = -ENOENT;
+ goto out;
+ }
++ if (cmd->status != BLK_STS_OK) {
++ dev_err(disk_to_dev(nbd->disk), "Command already handled %p\n",
++ req);
++ ret = -ENOENT;
++ goto out;
++ }
+ if (test_bit(NBD_CMD_REQUEUED, &cmd->flags)) {
+ dev_err(disk_to_dev(nbd->disk), "Raced with timeout on req %p\n",
+ req);
+--
+2.20.1
+
--- /dev/null
+From 250c5d25828289d6d45377f3ae329bde7113a930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 15:56:27 -0400
+Subject: nbd: protect cmd->status with cmd->lock
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit de6346ecbc8f5591ebd6c44ac164e8b8671d71d7 ]
+
+We already do this for the most part, except in timeout and clear_req.
+For the timeout case we take the lock after we grab a ref on the config,
+but that isn't really necessary because we're safe to touch the cmd at
+this point, so just move the order around.
+
+For the clear_req cause this is initiated by the user, so again is safe.
+
+Reviewed-by: Mike Christie <mchristi@redhat.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index bd9aafe86c2fc..da6a36d14f4cf 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -349,17 +349,16 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,
+ struct nbd_device *nbd = cmd->nbd;
+ struct nbd_config *config;
+
++ if (!mutex_trylock(&cmd->lock))
++ return BLK_EH_RESET_TIMER;
++
+ if (!refcount_inc_not_zero(&nbd->config_refs)) {
+ cmd->status = BLK_STS_TIMEOUT;
++ mutex_unlock(&cmd->lock);
+ goto done;
+ }
+ config = nbd->config;
+
+- if (!mutex_trylock(&cmd->lock)) {
+- nbd_config_put(nbd);
+- return BLK_EH_RESET_TIMER;
+- }
+-
+ if (config->num_connections > 1) {
+ dev_err_ratelimited(nbd_to_dev(nbd),
+ "Connection timed out, retrying (%d/%d alive)\n",
+@@ -745,7 +744,10 @@ static void nbd_clear_req(struct request *req, void *data, bool reserved)
+ {
+ struct nbd_cmd *cmd = blk_mq_rq_to_pdu(req);
+
++ mutex_lock(&cmd->lock);
+ cmd->status = BLK_STS_IOERR;
++ mutex_unlock(&cmd->lock);
++
+ blk_mq_complete_request(req);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2740bc8c010ea1b4c23619739f66bbef7e61300f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 13:58:43 -0500
+Subject: of: unittest: fix memory leak in unittest_data_add
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit e13de8fe0d6a51341671bbe384826d527afe8d44 ]
+
+In unittest_data_add, a copy buffer is created via kmemdup. This buffer
+is leaked if of_fdt_unflatten_tree fails. The release for the
+unittest_data buffer is added.
+
+Fixes: b951f9dc7f25 ("Enabling OF selftest to run without machine's devicetree")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Frank Rowand <frowand.list@gmail.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 7f42314da6ae3..bac4b4bbc33de 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -1159,6 +1159,7 @@ static int __init unittest_data_add(void)
+ of_fdt_unflatten_tree(unittest_data, NULL, &unittest_data_node);
+ if (!unittest_data_node) {
+ pr_warn("%s: No tree to attach; not running tests\n", __func__);
++ kfree(unittest_data);
+ return -ENODATA;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c88f6768060ad87037a21acf899a535a3e125265 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2019 10:54:14 +0800
+Subject: perf c2c: Fix memory leak in build_cl_output()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit ae199c580da1754a2b051321eeb76d6dacd8707b ]
+
+There is a memory leak problem in the failure paths of
+build_cl_output(), so fix it.
+
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Hu Shiyuan <hushiyuan@huawei.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/4d3c0178-5482-c313-98e1-f82090d2d456@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-c2c.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
+index 763c2edf52e7d..1452e5153c604 100644
+--- a/tools/perf/builtin-c2c.c
++++ b/tools/perf/builtin-c2c.c
+@@ -2626,6 +2626,7 @@ static int build_cl_output(char *cl_sort, bool no_source)
+ bool add_sym = false;
+ bool add_dso = false;
+ bool add_src = false;
++ int ret = 0;
+
+ if (!buf)
+ return -ENOMEM;
+@@ -2644,7 +2645,8 @@ static int build_cl_output(char *cl_sort, bool no_source)
+ add_dso = true;
+ } else if (strcmp(tok, "offset")) {
+ pr_err("unrecognized sort token: %s\n", tok);
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err;
+ }
+ }
+
+@@ -2667,13 +2669,15 @@ static int build_cl_output(char *cl_sort, bool no_source)
+ add_sym ? "symbol," : "",
+ add_dso ? "dso," : "",
+ add_src ? "cl_srcline," : "",
+- "node") < 0)
+- return -ENOMEM;
++ "node") < 0) {
++ ret = -ENOMEM;
++ goto err;
++ }
+
+ c2c.show_src = add_src;
+-
++err:
+ free(buf);
+- return 0;
++ return ret;
+ }
+
+ static int setup_coalesce(const char *coalesce, bool no_source)
+--
+2.20.1
+
--- /dev/null
+From 97b421952c209e5b7b57431183423095f996105b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 16:38:45 +0800
+Subject: perf kmem: Fix memory leak in compact_gfp_flags()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit 1abecfcaa7bba21c9985e0136fa49836164dd8fd ]
+
+The memory @orig_flags is allocated by strdup(), it is freed on the
+normal path, but leak to free on the error path.
+
+Fix this by adding free(orig_flags) on the error path.
+
+Fixes: 0e11115644b3 ("perf kmem: Print gfp flags in human readable string")
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Hu Shiyuan <hushiyuan@huawei.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/f9e9f458-96f3-4a97-a1d5-9feec2420e07@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-kmem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/builtin-kmem.c b/tools/perf/builtin-kmem.c
+index b63bca4b0c2a6..56dd5d1476e06 100644
+--- a/tools/perf/builtin-kmem.c
++++ b/tools/perf/builtin-kmem.c
+@@ -686,6 +686,7 @@ static char *compact_gfp_flags(char *gfp_flags)
+ new = realloc(new_flags, len + strlen(cpt) + 2);
+ if (new == NULL) {
+ free(new_flags);
++ free(orig_flags);
+ return NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From b0fdea9fefb50a233adae6c474ffa84e7dc048e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2019 11:14:26 +0300
+Subject: pinctrl: ns2: Fix off by one bugs in ns2_pinmux_enable()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 39b65fbb813089e366b376bd8acc300b6fd646dc ]
+
+The pinctrl->functions[] array has pinctrl->num_functions elements and
+the pinctrl->groups[] array is the same way. These are set in
+ns2_pinmux_probe(). So the > comparisons should be >= so that we don't
+read one element beyond the end of the array.
+
+Fixes: b5aa1006e4a9 ("pinctrl: ns2: add pinmux driver support for Broadcom NS2 SoC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20190926081426.GB2332@mwanda
+Acked-by: Scott Branden <scott.branden@broadcom.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/bcm/pinctrl-ns2-mux.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-ns2-mux.c b/drivers/pinctrl/bcm/pinctrl-ns2-mux.c
+index 4b5cf0e0f16e2..951090faa6a91 100644
+--- a/drivers/pinctrl/bcm/pinctrl-ns2-mux.c
++++ b/drivers/pinctrl/bcm/pinctrl-ns2-mux.c
+@@ -640,8 +640,8 @@ static int ns2_pinmux_enable(struct pinctrl_dev *pctrl_dev,
+ const struct ns2_pin_function *func;
+ const struct ns2_pin_group *grp;
+
+- if (grp_select > pinctrl->num_groups ||
+- func_select > pinctrl->num_functions)
++ if (grp_select >= pinctrl->num_groups ||
++ func_select >= pinctrl->num_functions)
+ return -EINVAL;
+
+ func = &pinctrl->functions[func_select];
+--
+2.20.1
+
--- /dev/null
+From 6208e46c910aa92e8e4c5562f8d85000c7b5f95d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2019 17:40:20 +0200
+Subject: regulator: of: fix suspend-min/max-voltage parsing
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit 131cb1210d4b58acb0695707dad2eb90dcb50a2a ]
+
+Currently the regulator-suspend-min/max-microvolt must be within the
+root regulator node but the dt-bindings specifies it as subnode
+properties for the regulator-state-[mem/disk/standby] node. The only DT
+using this bindings currently is the at91-sama5d2_xplained.dts and this
+DT uses it correctly. I don't know if it isn't tested but it can't work
+without this fix.
+
+Fixes: f7efad10b5c4 ("regulator: add PM suspend and resume hooks")
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Link: https://lore.kernel.org/r/20190917154021.14693-3-m.felsch@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/of_regulator.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
+index 210fc20f7de7a..b255590aef36e 100644
+--- a/drivers/regulator/of_regulator.c
++++ b/drivers/regulator/of_regulator.c
+@@ -214,12 +214,12 @@ static void of_get_regulation_constraints(struct device_node *np,
+ "regulator-off-in-suspend"))
+ suspend_state->enabled = DISABLE_IN_SUSPEND;
+
+- if (!of_property_read_u32(np, "regulator-suspend-min-microvolt",
+- &pval))
++ if (!of_property_read_u32(suspend_np,
++ "regulator-suspend-min-microvolt", &pval))
+ suspend_state->min_uV = pval;
+
+- if (!of_property_read_u32(np, "regulator-suspend-max-microvolt",
+- &pval))
++ if (!of_property_read_u32(suspend_np,
++ "regulator-suspend-max-microvolt", &pval))
+ suspend_state->max_uV = pval;
+
+ if (!of_property_read_u32(suspend_np,
+--
+2.20.1
+
--- /dev/null
+From 78248d72ffb31076df0ca7ea86278731b319a491 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 10:09:57 -0700
+Subject: regulator: pfuze100-regulator: Variable "val" in
+ pfuze100_regulator_probe() could be uninitialized
+
+From: Yizhuo <yzhai003@ucr.edu>
+
+[ Upstream commit 1252b283141f03c3dffd139292c862cae10e174d ]
+
+In function pfuze100_regulator_probe(), variable "val" could be
+initialized if regmap_read() fails. However, "val" is used to
+decide the control flow later in the if statement, which is
+potentially unsafe.
+
+Signed-off-by: Yizhuo <yzhai003@ucr.edu>
+Link: https://lore.kernel.org/r/20190929170957.14775-1-yzhai003@ucr.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pfuze100-regulator.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index 31c3a236120a8..69a377ab26041 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -710,7 +710,13 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
+
+ /* SW2~SW4 high bit check and modify the voltage value table */
+ if (i >= sw_check_start && i <= sw_check_end) {
+- regmap_read(pfuze_chip->regmap, desc->vsel_reg, &val);
++ ret = regmap_read(pfuze_chip->regmap,
++ desc->vsel_reg, &val);
++ if (ret) {
++ dev_err(&client->dev, "Fails to read from the register.\n");
++ return ret;
++ }
++
+ if (val & sw_hi) {
+ if (pfuze_chip->chip_id == PFUZE3000 ||
+ pfuze_chip->chip_id == PFUZE3001) {
+--
+2.20.1
+
--- /dev/null
+From ad680516e7154579b4da1d2b65e7c470e029468a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 17:58:48 +0800
+Subject: regulator: ti-abb: Fix timeout in
+ ti_abb_wait_txdone/ti_abb_clear_all_txdone
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit f64db548799e0330897c3203680c2ee795ade518 ]
+
+ti_abb_wait_txdone() may return -ETIMEDOUT when ti_abb_check_txdone()
+returns true in the latest iteration of the while loop because the timeout
+value is abb->settling_time + 1. Similarly, ti_abb_clear_all_txdone() may
+return -ETIMEDOUT when ti_abb_check_txdone() returns false in the latest
+iteration of the while loop. Fix it.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Nishanth Menon <nm@ti.com>
+Link: https://lore.kernel.org/r/20190929095848.21960-1-axel.lin@ingics.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/ti-abb-regulator.c | 26 ++++++++------------------
+ 1 file changed, 8 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
+index cced1ffb896c1..89b9314d64c9d 100644
+--- a/drivers/regulator/ti-abb-regulator.c
++++ b/drivers/regulator/ti-abb-regulator.c
+@@ -173,19 +173,14 @@ static int ti_abb_wait_txdone(struct device *dev, struct ti_abb *abb)
+ while (timeout++ <= abb->settling_time) {
+ status = ti_abb_check_txdone(abb);
+ if (status)
+- break;
++ return 0;
+
+ udelay(1);
+ }
+
+- if (timeout > abb->settling_time) {
+- dev_warn_ratelimited(dev,
+- "%s:TRANXDONE timeout(%duS) int=0x%08x\n",
+- __func__, timeout, readl(abb->int_base));
+- return -ETIMEDOUT;
+- }
+-
+- return 0;
++ dev_warn_ratelimited(dev, "%s:TRANXDONE timeout(%duS) int=0x%08x\n",
++ __func__, timeout, readl(abb->int_base));
++ return -ETIMEDOUT;
+ }
+
+ /**
+@@ -205,19 +200,14 @@ static int ti_abb_clear_all_txdone(struct device *dev, const struct ti_abb *abb)
+
+ status = ti_abb_check_txdone(abb);
+ if (!status)
+- break;
++ return 0;
+
+ udelay(1);
+ }
+
+- if (timeout > abb->settling_time) {
+- dev_warn_ratelimited(dev,
+- "%s:TRANXDONE timeout(%duS) int=0x%08x\n",
+- __func__, timeout, readl(abb->int_base));
+- return -ETIMEDOUT;
+- }
+-
+- return 0;
++ dev_warn_ratelimited(dev, "%s:TRANXDONE timeout(%duS) int=0x%08x\n",
++ __func__, timeout, readl(abb->int_base));
++ return -ETIMEDOUT;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 158333dc7b2abe3c10cfa3e2801718feff0e200c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:11:28 +0200
+Subject: scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE
+
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+
+[ Upstream commit 8cbf0c173aa096dda526d1ccd66fc751c31da346 ]
+
+When building a kernel with SCSI_SNI_53C710 enabled, Kconfig warns:
+
+WARNING: unmet direct dependencies detected for 53C700_LE_ON_BE
+ Depends on [n]: SCSI_LOWLEVEL [=y] && SCSI [=y] && SCSI_LASI700 [=n]
+ Selected by [y]:
+ - SCSI_SNI_53C710 [=y] && SCSI_LOWLEVEL [=y] && SNI_RM [=y] && SCSI [=y]
+
+Add the missing depends SCSI_SNI_53C710 to 53C700_LE_ON_BE to fix it.
+
+Link: https://lore.kernel.org/r/20191009151128.32411-1-tbogendoerfer@suse.de
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
+index 7c097006c54db..a8ac480276323 100644
+--- a/drivers/scsi/Kconfig
++++ b/drivers/scsi/Kconfig
+@@ -862,7 +862,7 @@ config SCSI_SNI_53C710
+
+ config 53C700_LE_ON_BE
+ bool
+- depends on SCSI_LASI700
++ depends on SCSI_LASI700 || SCSI_SNI_53C710
+ default y
+
+ config SCSI_STEX
+--
+2.20.1
+
--- /dev/null
+From 22fee093402c22e35547429ba4e5d83033d4ba25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 22:06:58 +0530
+Subject: scsi: qla2xxx: fix a potential NULL pointer dereference
+
+From: Allen Pais <allen.pais@oracle.com>
+
+[ Upstream commit 35a79a63517981a8aea395497c548776347deda8 ]
+
+alloc_workqueue is not checked for errors and as a result a potential
+NULL dereference could occur.
+
+Link: https://lore.kernel.org/r/1568824618-4366-1-git-send-email-allen.pais@oracle.com
+Signed-off-by: Allen Pais <allen.pais@oracle.com>
+Reviewed-by: Martin Wilck <mwilck@suse.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 60b6019a2fcae..856a7ceb9a041 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3186,6 +3186,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ req->req_q_in, req->req_q_out, rsp->rsp_q_in, rsp->rsp_q_out);
+
+ ha->wq = alloc_workqueue("qla2xxx_wq", 0, 0);
++ if (unlikely(!ha->wq)) {
++ ret = -ENOMEM;
++ goto probe_failed;
++ }
+
+ if (ha->isp_ops->initialize_adapter(base_vha)) {
+ ql_log(ql_log_fatal, base_vha, 0x00d6,
+--
+2.20.1
+
--- /dev/null
+From 6803b0ead6bc3b2176028970220dc1cd5545a02d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 15:57:01 +0200
+Subject: scsi: scsi_dh_alua: handle RTPG sense code correctly during state
+ transitions
+
+From: Hannes Reinecke <hare@suse.com>
+
+[ Upstream commit b6ce6fb121a655aefe41dccc077141c102145a37 ]
+
+Some arrays are not capable of returning RTPG data during state
+transitioning, but rather return an 'LUN not accessible, asymmetric access
+state transition' sense code. In these cases we can set the state to
+'transitioning' directly and don't need to evaluate the RTPG data (which we
+won't have anyway).
+
+Link: https://lore.kernel.org/r/20191007135701.32389-1-hare@suse.de
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/device_handler/scsi_dh_alua.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
+index 9c21938ed67ed..c95c782b93a53 100644
+--- a/drivers/scsi/device_handler/scsi_dh_alua.c
++++ b/drivers/scsi/device_handler/scsi_dh_alua.c
+@@ -526,6 +526,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ unsigned int tpg_desc_tbl_off;
+ unsigned char orig_transition_tmo;
+ unsigned long flags;
++ bool transitioning_sense = false;
+
+ if (!pg->expiry) {
+ unsigned long transition_tmo = ALUA_FAILOVER_TIMEOUT * HZ;
+@@ -586,13 +587,19 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ goto retry;
+ }
+ /*
+- * Retry on ALUA state transition or if any
+- * UNIT ATTENTION occurred.
++ * If the array returns with 'ALUA state transition'
++ * sense code here it cannot return RTPG data during
++ * transition. So set the state to 'transitioning' directly.
+ */
+ if (sense_hdr.sense_key == NOT_READY &&
+- sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a)
+- err = SCSI_DH_RETRY;
+- else if (sense_hdr.sense_key == UNIT_ATTENTION)
++ sense_hdr.asc == 0x04 && sense_hdr.ascq == 0x0a) {
++ transitioning_sense = true;
++ goto skip_rtpg;
++ }
++ /*
++ * Retry on any other UNIT ATTENTION occurred.
++ */
++ if (sense_hdr.sense_key == UNIT_ATTENTION)
+ err = SCSI_DH_RETRY;
+ if (err == SCSI_DH_RETRY &&
+ pg->expiry != 0 && time_before(jiffies, pg->expiry)) {
+@@ -680,7 +687,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)
+ off = 8 + (desc[7] * 4);
+ }
+
++ skip_rtpg:
+ spin_lock_irqsave(&pg->lock, flags);
++ if (transitioning_sense)
++ pg->state = SCSI_ACCESS_STATE_TRANSITIONING;
++
+ sdev_printk(KERN_INFO, sdev,
+ "%s: port group %02x state %c %s supports %c%c%c%c%c%c%c\n",
+ ALUA_DH_NAME, pg->group_id, print_alua_state(pg->state),
+--
+2.20.1
+
--- /dev/null
+From 3486107cb8231a02810e12e2ed1b1af4c2df3728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:11:18 +0200
+Subject: scsi: sni_53c710: fix compilation error
+
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+
+[ Upstream commit 0ee6211408a8e939428f662833c7301394125b80 ]
+
+Drop out memory dev_printk() with wrong device pointer argument.
+
+[mkp: typo]
+
+Link: https://lore.kernel.org/r/20191009151118.32350-1-tbogendoerfer@suse.de
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/sni_53c710.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/sni_53c710.c b/drivers/scsi/sni_53c710.c
+index 1f9a087daf69f..3102a75984d3b 100644
+--- a/drivers/scsi/sni_53c710.c
++++ b/drivers/scsi/sni_53c710.c
+@@ -78,10 +78,8 @@ static int snirm710_probe(struct platform_device *dev)
+
+ base = res->start;
+ hostdata = kzalloc(sizeof(*hostdata), GFP_KERNEL);
+- if (!hostdata) {
+- dev_printk(KERN_ERR, dev, "Failed to allocate host data\n");
++ if (!hostdata)
+ return -ENOMEM;
+- }
+
+ hostdata->dev = &dev->dev;
+ dma_set_mask(&dev->dev, DMA_BIT_MASK(32));
+--
+2.20.1
+
--- /dev/null
+From 7568c90b4a3579acaba98fa3d9f063125f440a77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 20:29:04 +0200
+Subject: scsi: target: core: Do not overwrite CDB byte 1
+
+From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+
+[ Upstream commit 27e84243cb63601a10e366afe3e2d05bb03c1cb5 ]
+
+passthrough_parse_cdb() - used by TCMU and PSCSI - attepts to reset the LUN
+field of SCSI-2 CDBs (bits 5,6,7 of byte 1). The current code is wrong as
+for newer commands not having the LUN field it overwrites relevant command
+bits (e.g. for SECURITY PROTOCOL IN / OUT). We think this code was
+unnecessary from the beginning or at least it is no longer useful. So we
+remove it entirely.
+
+Link: https://lore.kernel.org/r/12498eab-76fd-eaad-1316-c2827badb76a@ts.fujitsu.com
+Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_device.c | 21 ---------------------
+ 1 file changed, 21 deletions(-)
+
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 47b5ef153135c..e9ff2a7c0c0e6 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -1128,27 +1128,6 @@ passthrough_parse_cdb(struct se_cmd *cmd,
+ struct se_device *dev = cmd->se_dev;
+ unsigned int size;
+
+- /*
+- * Clear a lun set in the cdb if the initiator talking to use spoke
+- * and old standards version, as we can't assume the underlying device
+- * won't choke up on it.
+- */
+- switch (cdb[0]) {
+- case READ_10: /* SBC - RDProtect */
+- case READ_12: /* SBC - RDProtect */
+- case READ_16: /* SBC - RDProtect */
+- case SEND_DIAGNOSTIC: /* SPC - SELF-TEST Code */
+- case VERIFY: /* SBC - VRProtect */
+- case VERIFY_16: /* SBC - VRProtect */
+- case WRITE_VERIFY: /* SBC - VRProtect */
+- case WRITE_VERIFY_12: /* SBC - VRProtect */
+- case MAINTENANCE_IN: /* SPC - Parameter Data Format for SA RTPG */
+- break;
+- default:
+- cdb[1] &= 0x1f; /* clear logical unit number */
+- break;
+- }
+-
+ /*
+ * For REPORT LUNS we always need to emulate the response, for everything
+ * else, pass it up.
+--
+2.20.1
+
--- /dev/null
+kbuild-add-fcf-protection-none-when-using-retpoline-.patch
+regulator-of-fix-suspend-min-max-voltage-parsing.patch
+asoc-wm8994-do-not-register-inapplicable-controls-fo.patch
+arm64-dts-allwinner-a64-pine64-plus-add-phy-regulato.patch
+arm64-dts-allwinner-a64-sopine-baseboard-add-phy-reg.patch
+arm64-dts-fix-gpio-to-pinmux-mapping.patch
+regulator-ti-abb-fix-timeout-in-ti_abb_wait_txdone-t.patch
+asoc-rt5682-add-null-handler-to-set_jack-function.patch
+regulator-pfuze100-regulator-variable-val-in-pfuze10.patch
+asoc-wm_adsp-don-t-generate-kcontrols-without-read-f.patch
+asoc-rockchip-i2s-fix-rpm-imbalance.patch
+arm-dts-logicpd-torpedo-som-remove-twl_keypad.patch
+pinctrl-ns2-fix-off-by-one-bugs-in-ns2_pinmux_enable.patch
+arm-mm-fix-alignment-handler-faults-under-memory-pre.patch
+scsi-qla2xxx-fix-a-potential-null-pointer-dereferenc.patch
+scsi-scsi_dh_alua-handle-rtpg-sense-code-correctly-d.patch
+scsi-sni_53c710-fix-compilation-error.patch
+scsi-fix-kconfig-dependency-warning-related-to-53c70.patch
+arm-dts-imx7s-correct-gpt-s-ipg-clock-source.patch
+perf-c2c-fix-memory-leak-in-build_cl_output.patch
+8250-men-mcb-fix-error-checking-when-get_num_ports-r.patch
+perf-kmem-fix-memory-leak-in-compact_gfp_flags.patch
+arm-davinci-dm365-fix-mcbsp-dma_slave_map-entry.patch
+drm-amdgpu-fix-potential-vm-faults.patch
+scsi-target-core-do-not-overwrite-cdb-byte-1.patch
+tracing-fix-gfp_t-format-for-synthetic-events.patch
+arm-8926-1-v7m-remove-register-save-to-stack-before-.patch
+of-unittest-fix-memory-leak-in-unittest_data_add.patch
+mips-bmips-mark-exception-vectors-as-char-arrays.patch
+irqchip-gic-v3-its-use-the-exact-itslist-for-vmovp.patch
+i2c-stm32f7-fix-first-byte-to-send-in-slave-mode.patch
+i2c-stm32f7-fix-a-race-in-slave-mode-with-arbitratio.patch
+i2c-stm32f7-remove-warning-when-compiling-with-w-1.patch
+cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconn.patch
+nbd-protect-cmd-status-with-cmd-lock.patch
+nbd-handle-racing-with-error-ed-out-commands.patch
--- /dev/null
+From a98c9812186e89c84a5618e204df38e9ad0ae85c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 09:20:34 +0800
+Subject: tracing: Fix "gfp_t" format for synthetic events
+
+From: Zhengjun Xing <zhengjun.xing@linux.intel.com>
+
+[ Upstream commit 9fa8c9c647be624e91b09ecffa7cd97ee0600b40 ]
+
+In the format of synthetic events, the "gfp_t" is shown as "signed:1",
+but in fact the "gfp_t" is "unsigned", should be shown as "signed:0".
+
+The issue can be reproduced by the following commands:
+
+echo 'memlatency u64 lat; unsigned int order; gfp_t gfp_flags; int migratetype' > /sys/kernel/debug/tracing/synthetic_events
+cat /sys/kernel/debug/tracing/events/synthetic/memlatency/format
+
+name: memlatency
+ID: 2233
+format:
+ field:unsigned short common_type; offset:0; size:2; signed:0;
+ field:unsigned char common_flags; offset:2; size:1; signed:0;
+ field:unsigned char common_preempt_count; offset:3; size:1; signed:0;
+ field:int common_pid; offset:4; size:4; signed:1;
+
+ field:u64 lat; offset:8; size:8; signed:0;
+ field:unsigned int order; offset:16; size:4; signed:0;
+ field:gfp_t gfp_flags; offset:24; size:4; signed:1;
+ field:int migratetype; offset:32; size:4; signed:1;
+
+print fmt: "lat=%llu, order=%u, gfp_flags=%x, migratetype=%d", REC->lat, REC->order, REC->gfp_flags, REC->migratetype
+
+Link: http://lkml.kernel.org/r/20191018012034.6404-1-zhengjun.xing@linux.intel.com
+
+Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Zhengjun Xing <zhengjun.xing@linux.intel.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_hist.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index bdf104596d122..dac518977e7d0 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -448,6 +448,8 @@ static bool synth_field_signed(char *type)
+ {
+ if (strncmp(type, "u", 1) == 0)
+ return false;
++ if (strcmp(type, "gfp_t") == 0)
++ return false;
+
+ return true;
+ }
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
